French delivery-tracking provider Shipup breached; Carrefour and other retailers' customer data exposed

According to fuitededonnées.fr, Carrefour confirmed some customers' names, emails and phone numbers were exposed after a cyberattack on its delivery-tracking provider, which security watchers identify as Shipup ^[1]. Per Le Monde Informatique, the compromise stemmed from a critical Metabase vulnerability, and Micromania, Easypara and Printemps also reported exposure; Carrefour says bank details and passwords were not compromised ^[1]. fuitededonnées.fr advises ignoring texts or emails requesting bank details or payment and tracking parcels only via official sites or apps, never via received links ^[1].

Industries mainly affected: Retail

1. Ignore texts or emails asking for bank details or payment, even if they mention Carrefour ^[1].
2. Track parcels only via official sites or apps, never via received links ^[1].
3. Report suspicious messages to SignalConso, Pharos or Thesee and enable 2FA .